EvilTokens: what Australian security partners should tell customers

Business email compromise is already one of the most familiar threats Australian organisations face. What has changed is the speed. Microsoft's latest action against a cybercrime service shows how AI can turn a single compromised inbox into a fraud plan within minutes, and Australia was squarely in the firing line.

For MSPs, managed security providers and Microsoft security partners, this is more than a news story. It's a concrete, local reason to start a conversation with customers about identity, tokens and payment controls.

What Microsoft announced

Microsoft says its Digital Crimes Unit has disrupted EvilTokens, a service that combined account compromise with an AI chatbot designed to analyse stolen mailboxes. Key points from Microsoft:

• Since launching in February 2026, EvilTokens was linked to more than 12,000 compromised inboxes across more than 10,000 organisations.
• The highest concentrations of victim activity were in the US, Canada, the UK, Australia, India and France. Affected sectors included wholesale, construction, financial services, real estate, higher education and healthcare.
• Attackers used device-code phishing. Victims entered a code on Microsoft's genuine sign-in page, granting access without revealing a password. That access could survive a password reset unless sessions and tokens were also revoked.
• Once inside, the AI tooling summarised emails, mapped who approves payments, surfaced vendor invoices and suggested who to impersonate.
• Microsoft says it was sold through Telegram for a $1,500 initiation fee plus a recurring $500 subscription.
• Microsoft seized 50 websites and disabled more than 150 additional domains, with Health-ISAC as co-plaintiff and help from several technology and security companies. The UK Metropolitan Police arrested two men on 11 September 2026.
• Microsoft describes it as the DCU's 40th court-authorised disruption, and its first against an end-to-end AI-enabled cybercrime service.

Why it matters for Microsoft partners

There's a direct Australian hook. Security messaging often relies on global statistics that feel distant to local buyers. Here, Microsoft has named Australia among the most affected countries. That makes it relevant to boards, finance teams and IT managers in sectors like construction, wholesale and professional services, where payment fraud hurts most.

The playbook for compromised accounts needs updating. Many organisations still treat "reset the password" as the fix. Microsoft's description of token persistence shows why that's not enough. Partners who can audit conditional access, restrict device-code flows where appropriate and build token revocation into incident response have a clear, defensible service.

Fraud is now a finance problem as much as an IT problem. EvilTokens targeted the people who move money. That widens the buyer group for security partners to include CFOs and finance managers, who are often easier to engage on fraud risk than on technical controls.

AI cuts both ways. Microsoft notes that its investigators also used AI tools to analyse evidence and map infrastructure. Partners can use this balance to avoid fear-led messaging: AI raises the stakes, but it also strengthens defence when it's applied well.

What partners should do next

1. Run an identity and token review campaign. Offer a fixed-scope assessment covering sign-in policies, device-code usage, session lifetimes and token revocation procedures. Lead with the Australian angle and keep the offer simple.
2. Bring finance into the conversation. Create a short briefing for finance leaders on verifying payment changes through a second channel. A joint webinar with an accounting or legal partner can broaden reach.
3. Update your incident response runbooks. Make sure token and session revocation is part of every account compromise response, and say so in your service descriptions.
4. Refresh security content for AI search. Publish clear, question-led explainers on device-code phishing and business email compromise. Structured answers help your content appear in AI assistants, which is the heart of answer engine optimisation.
5. Align with Microsoft security plays. If your identity or managed security offers are listed on Microsoft Marketplace, make sure the listing reflects these threats, and raise them in co-sell planning.
6. Keep the tone measured. Reference Microsoft's findings accurately and avoid inflating the local impact. Credibility is a security partner's most valuable asset.

How UBE can help

UBE builds security campaigns for Microsoft partners that are accurate, locally relevant and designed to start real conversations. Speak with our demand generation team or get in touch to plan an identity security campaign.